Implementation of GDPR principles in claims handling 25 May 2018 No.18-001 Tweet Download PDF (282KB) As advised in our circular dated 16 March 2018, the EU's General Data Protection Regulation (“GDPR”) provides for significant penalties in the event of a data breach. The purpose of this circular is to provide members, correspondents and others with further guidance on how to try and reduce the risk of a breach and advise you of some changes we will be making in how we handle personal data.As advised in our circular dated 3 March 2018, the General Data Protection Regulation (“GDPR”) provides for significant penalties in the event of a data breach. The purpose of this circular is to provide members, correspondents and others with further guidance on how to try and reduce the risk of a breach and advise you of some changes we will be making in how we handle personal data.   People claims such as those involving crew or passenger illness and injury present the greatest challenge to the Club in ensuring the adequate protection of personal data.   Data minimisation and privacy by design   As mentioned in our previous circular, the Club is a controller for the purposes of the GDPR, and thus responsible for demonstrating compliance with the Regulation. As a result and in line with the key GDPR principles of data minimisation and privacy by design, the Club wishes to   start limiting the amount of personal information in circulation, make greater use of existing technology to transfer personal data more securely and where possible, anonymise the data that is exchanged.   E-mail circulation lists continue to expand which means it can be difficult to spot when someone who should not be included has inserted themselves into an email chain. In addition, attempted fraud by e-mail is increasing, with communications received from impersonators of those involved in the industry. These imposters are usually seeking financial gain but responding to such a mes